mcp-google-multi 6.0.0-alpha.45 → 6.0.0-alpha.47

package/dist/compose.d.ts

@@ -0,0 +1,5 @@
+import type { McpServer } from "@modelcontextprotocol/server";
+import { ToolRegistry, type DiscoveryMode } from './registry.js';
+import type { IdentityContext } from './identity.js';
+import type { Metrics } from './usage-metrics.js';
+export declare function buildRegistry(server: McpServer, ctx: IdentityContext, mode?: DiscoveryMode, metrics?: Metrics | null): ToolRegistry;

package/dist/compose.js

@@ -0,0 +1,67 @@
+// S1.12: registry composition, extracted from index.ts so the tenancy module
+// (and tests) can build registries without touching the CLI entrypoint. This
+// module must stay free of import-time side effects of its own: no argv
+// parsing, no process.exit, no prints (accounts.js module-load resolution is
+// the one inherited, pre-existing exception on the import chain).
+import { GENERATED_SERVICES } from './tools/generated/index.js';
+import { GENERATED_GATES, SERVICES } from './services.js';
+import { ToolRegistry } from './registry.js';
+import { registerDiscoverTools } from './discover.js';
+import { registerEscapeTools } from './tools/google-api.js';
+import { registerAccountTools } from './tools/accounts-tool.js';
+import { registerDiagnoseTool } from './doctor.js';
+import { registerAccountWizardTools } from './tools/account-wizard.js';
+import { getToolsets, toolsetEnabled } from './toolsets.js';
+export function buildRegistry(server, ctx, mode, metrics = null) {
+    const policy = ctx.policy;
+    // The registry's account view IS the context's: fan-out expansion,
+    // selector validation and default-account injection all follow this
+    // context, not the process global (identical for the free core's one ctx).
+    const registry = new ToolRegistry(server, policy, mode, metrics, () => ctx.accounts);
+    const toolsets = getToolsets();
+    if (toolsets !== 'all') {
+        const known = new Set([...SERVICES.map((s) => s.name), ...GENERATED_SERVICES.map((s) => s.name)]);
+        for (const requested of toolsets) {
+            if (!known.has(requested)) {
+                process.stderr.write(`GOOGLE_TOOLSETS: unknown service "${requested}" ignored\n`);
+            }
+        }
+    }
+    for (const svc of SERVICES) {
+        if (!toolsetEnabled(toolsets, svc.name))
+            continue;
+        if (svc.enabled && !svc.enabled(ctx.accounts)) {
+            if (toolsets !== 'all') {
+                const hint = svc.name === 'admin' ? 'set admin on an account/profile (or GOOGLE_ADMIN_ACCOUNTS)' : `add "${svc.name}" to an account's scope profile (or legacy GOOGLE_OPTIONAL_SCOPES)`;
+                process.stderr.write(`GOOGLE_TOOLSETS: "${svc.name}" requested but not enabled — ${hint}\n`);
+            }
+            continue;
+        }
+        svc.register(registry);
+    }
+    for (const gen of GENERATED_SERVICES) {
+        if (!toolsetEnabled(toolsets, gen.name))
+            continue;
+        const curated = SERVICES.find((s) => s.name === gen.name);
+        const gate = curated?.enabled ?? GENERATED_GATES[gen.name]?.enabled;
+        if (gate && !gate(ctx.accounts)) {
+            if (!curated && toolsets !== 'all') {
+                process.stderr.write(`GOOGLE_TOOLSETS: "${gen.name}" requested but not enabled — ${GENERATED_GATES[gen.name].hint}\n`);
+            }
+            continue;
+        }
+        gen.register(registry);
+    }
+    if (registry.services().length === 0) {
+        const known = [...new Set([...SERVICES.map((s) => s.name), ...GENERATED_SERVICES.map((s) => s.name)])].sort();
+        throw new Error(`GOOGLE_TOOLSETS="${process.env.GOOGLE_TOOLSETS ?? ''}" selected no enabled services. ` +
+            `Known services: ${known.join(', ')}. ` +
+            `Note: optional services need their bundle in an account's scope profile (or legacy GOOGLE_OPTIONAL_SCOPES); admin needs an admin account/profile.`);
+    }
+    registerDiscoverTools(registry, policy);
+    registerEscapeTools(registry, policy);
+    registerAccountTools(registry);
+    registerDiagnoseTool(registry, ctx);
+    registerAccountWizardTools(registry, server);
+    return registry;
+}

package/dist/doctor.js

@@ -341,9 +341,35 @@ export function renderDoctorText(report) {
     out.push(`Overall: ${report.verdict.toUpperCase()}`);
     return out.join('\n');
 }
-/** Mask the local-part of an email so a report never carries a full address (BR8). */
+const EMAIL_LOCAL_CHAR = /[A-Za-z0-9._%+-]/;
+const EMAIL_DOMAIN_CHAR = /[A-Za-z0-9.-]/;
+/** Mask the local-part of an email so a report never carries a full address
+ * (BR8). A linear scan, not a regex: the `local* @domain` pattern backtracks
+ * polynomially on long local-charset runs without an @ (CodeQL
+ * js/polynomial-redos), and report text can embed arbitrary error strings. */
 function maskEmails(text) {
-    return text.replace(/([A-Za-z0-9._%+-])[A-Za-z0-9._%+-]*(@[A-Za-z0-9.-]+)/g, '$1***$2');
+    let out = '';
+    let i = 0;
+    while (i < text.length) {
+        if (text[i] === '@') {
+            let j = i + 1;
+            while (j < text.length && EMAIL_DOMAIN_CHAR.test(text[j]))
+                j += 1;
+            let k = out.length;
+            while (k > 0 && EMAIL_LOCAL_CHAR.test(out[k - 1]))
+                k -= 1;
+            if (j > i + 1 && k < out.length) {
+                // keep the first local char, mask the rest ('*' is outside the local
+                // charset, so a masked run can never be re-masked by a later @)
+                out = `${out.slice(0, k + 1)}***${text.slice(i, j)}`;
+                i = j;
+                continue;
+            }
+        }
+        out += text[i];
+        i += 1;
+    }
+    return out;
 }
 /** Redacted, paste-ready bug report (BR8): verdicts + provenance labels + token
  * statuses + slugs; NO token values, secrets, keys, or full email addresses. */

package/dist/index.js

@@ -8,17 +8,11 @@ import { fileURLToPath } from 'node:url';
 import path from 'node:path';
 import { StdioServerTransport } from "@modelcontextprotocol/server/stdio";
 import { McpServer } from "@modelcontextprotocol/server";
-import { GENERATED_SERVICES } from './tools/generated/index.js';
-import { GENERATED_GATES, SERVICES, unknownToolMessage } from './services.js';
-import { ToolRegistry, resolveDiscoveryMode } from './registry.js';
-import { registerDiscoverTools } from './discover.js';
-import { registerEscapeTools } from './tools/google-api.js';
-import { registerAccountTools } from './tools/accounts-tool.js';
-import { registerDiagnoseTool } from './doctor.js';
-import { registerAccountWizardTools } from './tools/account-wizard.js';
-import { getToolsets, toolsetEnabled } from './toolsets.js';
+import { unknownToolMessage } from './services.js';
+import { resolveDiscoveryMode } from './registry.js';
 import { isAllowed, describePolicy } from './write-control.js';
 import { buildIdentityContext } from './identity.js';
+import { buildRegistry } from './compose.js';
 import { registerSetupPrompt } from './setup-prompt.js';
 import { applyNetTuning } from './net-tuning.js';
 import { argNormalizationEnabled, withArgNormalization, withValidationEnvelope } from './arg-normalize.js';
@@ -43,56 +37,6 @@ function strictArgOptions(registry, metrics) {
         onDrop: metrics ? (tool, keys) => metrics.recordArgDrop(tool, keys) : undefined,
     };
 }
-function buildRegistry(server, ctx, mode, metrics = null) {
-    const policy = ctx.policy;
-    const registry = new ToolRegistry(server, policy, mode, metrics);
-    const toolsets = getToolsets();
-    if (toolsets !== 'all') {
-        const known = new Set([...SERVICES.map((s) => s.name), ...GENERATED_SERVICES.map((s) => s.name)]);
-        for (const requested of toolsets) {
-            if (!known.has(requested)) {
-                process.stderr.write(`GOOGLE_TOOLSETS: unknown service "${requested}" ignored\n`);
-            }
-        }
-    }
-    for (const svc of SERVICES) {
-        if (!toolsetEnabled(toolsets, svc.name))
-            continue;
-        if (svc.enabled && !svc.enabled(ctx.accounts)) {
-            if (toolsets !== 'all') {
-                const hint = svc.name === 'admin' ? 'set admin on an account/profile (or GOOGLE_ADMIN_ACCOUNTS)' : `add "${svc.name}" to an account's scope profile (or legacy GOOGLE_OPTIONAL_SCOPES)`;
-                process.stderr.write(`GOOGLE_TOOLSETS: "${svc.name}" requested but not enabled — ${hint}\n`);
-            }
-            continue;
-        }
-        svc.register(registry);
-    }
-    for (const gen of GENERATED_SERVICES) {
-        if (!toolsetEnabled(toolsets, gen.name))
-            continue;
-        const curated = SERVICES.find((s) => s.name === gen.name);
-        const gate = curated?.enabled ?? GENERATED_GATES[gen.name]?.enabled;
-        if (gate && !gate(ctx.accounts)) {
-            if (!curated && toolsets !== 'all') {
-                process.stderr.write(`GOOGLE_TOOLSETS: "${gen.name}" requested but not enabled — ${GENERATED_GATES[gen.name].hint}\n`);
-            }
-            continue;
-        }
-        gen.register(registry);
-    }
-    if (registry.services().length === 0) {
-        const known = [...new Set([...SERVICES.map((s) => s.name), ...GENERATED_SERVICES.map((s) => s.name)])].sort();
-        throw new Error(`GOOGLE_TOOLSETS="${process.env.GOOGLE_TOOLSETS ?? ''}" selected no enabled services. ` +
-            `Known services: ${known.join(', ')}. ` +
-            `Note: optional services need their bundle in an account's scope profile (or legacy GOOGLE_OPTIONAL_SCOPES); admin needs an admin account/profile.`);
-    }
-    registerDiscoverTools(registry, policy);
-    registerEscapeTools(registry, policy);
-    registerAccountTools(registry);
-    registerDiagnoseTool(registry, ctx);
-    registerAccountWizardTools(registry, server);
-    return registry;
-}
 async function main() {
     if (process.argv.includes('auth')) {
         const { runAuthFlow } = await import('./auth.js');

package/dist/registry-transfer.js

@@ -7,7 +7,7 @@
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import * as readline from 'node:readline';
 import path from 'node:path';
-import { encryptToken, decryptToken } from './token-store.js';
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'node:crypto';
 import { atomicWriteFileSync, atomicWriteWithLock } from './fs-atomic.js';
 import { ALIAS_RE, configFilePath, CONFIG_VERSION, tenantsDir } from './config-file.js';
 import { getTokenDir } from './accounts.js';
@@ -61,15 +61,52 @@ export function buildTransferBundle(exportedAt, deps = {}) {
     }
     return { manifest: { v: 1, exportedAt, aliases: [...aliasSet].sort() }, config, tokens };
 }
+// Bundle envelope v2: a REAL passphrase KDF. The v1 envelope reused the
+// token store's deriveKey, whose passphrase branch is one unsalted sha256 —
+// an exported bundle could be brute-forced offline (CodeQL
+// js/insufficient-password-hash). scrypt with a per-bundle random salt fixes
+// that; v1 bundles (a prerelease-only format, never produced by any stable
+// release) are refused with a re-export hint rather than kept decryptable.
+const BUNDLE_VERSION = 2;
+const SCRYPT_PARAMS = { N: 1 << 15, r: 8, p: 1, maxmem: 64 * 1024 * 1024 };
+function bundleKey(passphrase, salt) {
+    return scryptSync(passphrase, salt, 32, SCRYPT_PARAMS);
+}
 export function encryptBundle(bundle, passphrase) {
-    return encryptToken(bundle, passphrase);
+    const salt = randomBytes(16);
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', bundleKey(passphrase, salt), iv);
+    const data = Buffer.concat([cipher.update(Buffer.from(JSON.stringify(bundle), 'utf8')), cipher.final()]);
+    const file = {
+        bv: BUNDLE_VERSION,
+        salt: salt.toString('base64'),
+        iv: iv.toString('base64'),
+        tag: cipher.getAuthTag().toString('base64'),
+        data: data.toString('base64'),
+    };
+    return JSON.stringify(file);
 }
 export class BundleDecryptError extends Error {
 }
 export function decryptBundle(contents, passphrase) {
+    let file;
+    try {
+        file = JSON.parse(contents);
+    }
+    catch {
+        throw new BundleDecryptError('The file is not a registry export bundle.');
+    }
+    if (file.v !== undefined && file.bv === undefined) {
+        throw new BundleDecryptError('This bundle uses the retired v1 prerelease format (weak passphrase derivation); re-export it from the source machine with the current version.');
+    }
+    if (file.bv !== BUNDLE_VERSION || !file.salt || !file.iv || !file.tag || !file.data) {
+        throw new BundleDecryptError('The file is not a valid registry export (bad envelope).');
+    }
     let obj;
     try {
-        obj = decryptToken(contents, passphrase);
+        const decipher = createDecipheriv('aes-256-gcm', bundleKey(passphrase, Buffer.from(file.salt, 'base64')), Buffer.from(file.iv, 'base64'));
+        decipher.setAuthTag(Buffer.from(file.tag, 'base64'));
+        obj = JSON.parse(Buffer.concat([decipher.update(Buffer.from(file.data, 'base64')), decipher.final()]).toString('utf8'));
     }
     catch {
         throw new BundleDecryptError('Could not decrypt the bundle — wrong passphrase or the file is corrupt.');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.45",
+  "version": "6.0.0-alpha.47",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",
@@ -9,6 +9,24 @@
     "mcp-google-multi": "dist/index.js"
   },
   "main": "dist/index.js",
+  "exports": {
+    ".": "./dist/index.js",
+    "./identity": "./dist/identity.js",
+    "./compose": "./dist/compose.js",
+    "./registry": "./dist/registry.js",
+    "./oauth-as": "./dist/oauth-as.js",
+    "./accounts": "./dist/accounts.js",
+    "./token-store": "./dist/token-store.js",
+    "./http-transport": "./dist/http-transport.js",
+    "./http-config": "./dist/http-config.js",
+    "./client": "./dist/client.js",
+    "./config-file": "./dist/config-file.js",
+    "./mcp-token": "./dist/mcp-token.js",
+    "./boot-gates": "./dist/boot-gates.js",
+    "./tenant-purge": "./dist/tenant-purge.js",
+    "./doctor": "./dist/doctor.js",
+    "./package.json": "./package.json"
+  },
   "files": [
     "dist"
   ],